46ddb413e59f98ea7d1be571e205690badd41619da07d856ceeb8a6cc230e500

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

soundrts-1.2-c9-windows/ScreenReaderAPI.dll
Size

40KB
MD5

dbbab72c0e839ac5c8ea3ca1f6288493
SHA1

143f2a3125b2269d18d7d19aebb5bb79c42fbb80
SHA256

d1b4b6f7485c003a57f406d7e56681c172a1fb269a53501a339de61cc2c185ea
SHA512

3ccd08ead4bd6e5759e6010cba5e24ecb998687ac29b5b28e246b0e88f5843bffef61d0c71d1cbabccde43831a4e652442a221673d56254c6c0675fb0fa52075
SSDEEP

768:hGvgFWEPyO7VPNmEfCVNPtgM50wA3koOl5QF7YN0:mAWkyO7Vgc8NtgM54kl5fK

Score

1^/10

Malware Config

Signatures

Modifies registry class 15 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06C98751-54F6-433D-A751-D180789A854D}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06C98751-54F6-433D-A751-D180789A854D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ScreenReaderAPI.Interface	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ScreenReaderAPI.Interface\ = "Screen reader API COM Server"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06C98751-54F6-433D-A751-D180789A854D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06C98751-54F6-433D-A751-D180789A854D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\soundrts-1.2-c9-windows\\ScreenReaderAPI.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06C98751-54F6-433D-A751-D180789A854D}\InprocServer32\ThreadingModel = "both"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ScreenReaderAPI.Interface	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ScreenReaderAPI.Interface\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ScreenReaderAPI.Interface\CLSID\ = "{06C98751-54F6-433D-A751-D180789A854D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06C98751-54F6-433D-A751-D180789A854D}\ProgID\ = "ScreenReaderAPI.Interface"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06C98751-54F6-433D-A751-D180789A854D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06C98751-54F6-433D-A751-D180789A854D}\ = "Screen reader API COM Server"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ScreenReaderAPI.Interface\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06C98751-54F6-433D-A751-D180789A854D}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1340 wrote to memory of 4908	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 4908	1340	regsvr32.exe	regsvr32.exe
PID 1340 wrote to memory of 4908	1340	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\soundrts-1.2-c9-windows\ScreenReaderAPI.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\soundrts-1.2-c9-windows\ScreenReaderAPI.dll
  2⤵
  - Modifies registry class
  PID:4908

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads